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We present protocols for multiparty data hiding of quantum information that implement 
all possible threshold access structures. Closely related to secret sharing, data hiding has a 
more demanding security requirement: that the data remain secure against unrestricted 
LOCC attacks. In the limit of hiding a large amount of data, our protocols achieve an 
asymptotic rate of one hidden qubit per local physical qubit. That is, each party holds a 
V-Ij-" ■ share that is the same size as the hidden state to leading order, with accuracy and security 

parameters incurring an overhead that is asymptotically negligible. The data hiding states 
■ have very unusual entanglement properties, which we briefly discuss. 
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lO ■ In a variety of situations, it is desirable to distribute data among many parties in such a way 

that the parties can reconstruct the data only if they cooperate in a well-defined way. This problem 
has been studied in several settings, including the purely classical case [24], encoding classical 
data in quantum systems [10, 12, 13, 25], and encoding quantum data in quantum systems [8, 
9, 16, 19]. For the last two settings, at least two inequivalent security criteria can be applied. In 
quantum secret sharing [8, 16], certain authorized sets of parties are able to reconstruct the encoded 
data if they cooperate to implement a joint operation, whereas the remaining, unauthorized, sets 
are unable to get access regardless of what they do. In quantum data hiding [9, 10, 12, 13, 19, 25], the 
requirement for cooperation is increased. The data must remain inaccessible if any combination 
of the parties communicate classically, and can only be retrieved if the members of an authorized 
set perform a joint quantum mechanical operation, perhaps supplemented by classical advice from 
other parties outside the authorized set. 

Consider the following fanciful scenario. After the debacle of the year 2000 election, authorities 
in the state of Florida have decided to (do their best to) implement a tamper-proof vote counting 
system for the upcoming 2004 election. One feature of the new system is that every counting 
center must be attended by both a Democratic and a Republican observer. The system designers 
enforce this by encoding the ballot box access code using a quantum data hiding scheme requir- 
ing that the Democratic and Republican observers jointly implement a quantum operation to get 
access to the code. The difficulty inherent in implementing a quantum operation remotely offers 
some assurance that both observers will need to work together in the same place to extract the 
code. The scheme also offers flexibility in incorporating smaller political parties unable to field a 
full team of observers. The system could be designed, for example, such that the Greens would 
hold a share of the encoded state but not need to be physically present; their participation via 
classical communication would be sufficient. 

Relatively few data hiding schemes have been presented in the literature. The first examples 
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are to be found in [25] and [10], which demonstrate that classical bits can be hidden in bipartite 
Werner states. Generalizations to the multiparty setting realizing all sensible access structures are 
given by [12, 13]. The earliest schemes for hiding quantum data [9] are based on hiding a classical 
key that encrypts the quantum data. Much more efficient schemes for hiding quantum data di- 
rectly were presented for two parties in [19]. Here we generalize the method of [19] to construct 
(k, n) threshold hiding schemes, meaning that arbitrary classical communication in addition to 
quantum communication among any k parties is authorized, that is, sufficient to retrieve the data, 
but arbitrary classical communication along with quantum communication among groups of up 
to k — 1 parties is unauthorized. Our contribution extends the multipartite threshold access struc- 
ture results in [12, 13] to the domain of hiding quantum information, achieving an asymptotic 
rate of one hidden (logical) qubit per local physical qubit. Like the schemes in [19], those pre- 
sented here are significant improvements over the earlier multipartite results [9, 13] when a large 
number of qubits or even bits are to be hidden - the accuracy and security requirements incur 
additive (negligible) space overhead in our schemes and multiplicative (nonnegligible) overhead 
in previous constructions. Also, unlike quantum secret sharing, where the no-cloning theorem 
imposes the restriction that the complement of an authorized set be unauthorized, any threshold 
value k between 1 and n is possible. 

While presented in the language of cryptography, quantum data hiding is equally well a plat- 
form for the study of nonlocality. Indeed, the original proposal of [25] was motivated by the dis- 
covery of quantum nonlocality without entanglement, meaning sets of orthogonal product states 
that could not be distinguished by local operations and classical communication (LOCC) alone [4] . 
Since the original discovery, considerable effort has been devoted to understanding the relation- 
ship between local distinguishability and other types of nonlocality. (See [7, 11, 15, 21, 27] and 
references therein.) This paper continues that effort, in the sense that we present whole subspaces 
all of whose states are indistinguishable by LOCC but that can nonetheless be reconstructed by 
some collective operations, which are now more carefully prescribed than in the earlier work. 
Also, while much of that earlier work on local indistinguishability is devoted to determining 
when a finite set of states cannot be perfectly distinguished by LOCC, our focus here is at the 
other extreme, on near-perfect indistinguishability for entire subspaces. Moreover, in contrast to 
the emphasis on product states in [4], the results of [20] ensure that the states we choose here are 
by no means separable (they have near-maximal entanglement of formation) despite being LOCC 
indistinguishable from the maximally mixed state. 

Notation: We use the following conventions throughout the paper, log and exp are always taken 
base 2. Unless otherwise stated, a state can be pure or mixed. The density operator \<p)((p\ of 
the pure state \<p) will frequently be written simply as (p. V(d) denotes the unitary group on C d , 
B(C d ) the set of linear transformations from C d to C d and I the identity matrix. Physical operations 
mapping d\ -dimensional states to d,2 -dimensional states are completely positive trace-preserving 
(CPTP) maps from B(C dl ) to B(C d2 ). \\ ■ \\\ denotes the trace norm of a matrix and the 1-norm of 
a vector while || • ||2 denotes the Hilbert space norm. Pt(E) is used to represent the probability of 
event E. 
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II. DEFINITIONS AND RESULTS 



We begin with a formal definition of data hiding for quantum information: 

Definition 1 A (5, e, s, cP)-qubit hiding scheme with (k, n) access structure consists of a CPTP en- 
coding map, E : B(C S ) — > B(C dn ) and a set of CPTP decoding maps : C d " — ► B(C S ), one for each 
set Xofk parties, that can be implemented via quantum communication among the parties in X together 
with classical communication among all parties. The encoding and decodings must satisfy 

1. (Security) For all states (p and tpi on C s , along with all measurements L that can be implemented 
using arbitrary quantum communication within groupings of k — 1 or fewer parties and arbitrary 
classical communication between them, 



2. (Correctness) For all X and for all states <p on C s , \\{D^ o E)(ip) — <p\\i < 5. 

Notice that for k = 1 there are no unauthorized measurements, so that a qubit hiding scheme with 
(l,n) access structure is simply a method for implementing a kind of distributed data storage. 
Any one of the n parties can recover the quantum data with the help of only classical "advice" 
from the other n — 1 parties. We'll see that even in this simple setting, our approach will be 
considerably more efficient than the naive constructions based on local storage and teleportation 
or the more sophisticated proposals in [6]. 

The encoding map we will use is of the form 



where the Ui are in U(d n ) and we fix some inclusion C s = S C C d ™ for the encoded subspace; 
this is the same type of map used for approximate randomization and bipartite data hiding in 
[19]. Our strategy will be to show that if the Ui are selected independently and each according 
to the Haar measure on V(d n ), then for suitable choices of the parameters, E will provide a good 
encoding with non-zero probability (over the random U). Given a set of parties in quantum 
communication with each other, X, and its complement, W, our decoding map consists of 
local measurements by the parties in W, communication of the measurement outcomes to the 
parties in X, followed by a recovery procedure on X. More specifically, the decoding is achieved 
in a two step process. In the first step, A^ w \ each member of W performs a projection onto a 
fixed local basis, collectively {|0w}f=i / and sends the outcome to the members of X. Thus, if 
W consists of the parties Wi, W 2 , ■ ■ ■ , W n _ k , then has the structure A^ = A^ A^ ® 
...0 ^4(w n _ fc )_ An ar bitrary hidden state \<p) £ S is thereby transformed to the state = 
Z^dO^lw ® Ix)E(<p)(\l){l\w ® Ix), now entirely in the possession of the members of X since, 
post-measurement, the system W can be assumed to contain only the measurement outcomes, 
which get sent to X. 

They will then perform the transpose channel [2, 23] of the CPTP map AW o E adapted 
to the maximally mixed state on S. The transpose channel is a generic construction for approxi- 
mately reversing a quantum operation, which in the present case leads to the following definition 
for T( x \ Let P t := \l)(l\w ® Ix, Ps be the projector onto 5, and 



||L(£(^o))-L(i^i))||i <e. 
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FIG. 1: The encoding and decoding maps. 1(a) depicts the encoding procedure. A random Ui is applied 
to the state \(p) drawn from subspace S. The output, E(ip), is almost indistinguishable from the maximally 
mixed state using arbitrary LOCC and quantum communication within groupings of fc — 1 and fewer parties. 
1(b) depicts the decoding procedure. For any partition of the parties into an authorized set X of k parties and 
its complement W of n — k parties, the unauthorized parties W\, W2, ■ ■ ■ , W n -k perform the measurements 
A( w j) in fixed local bases, sending the outcomes to the authorized parties, who then apply the tranposc 
channel T^ x \ (Single lines represent quantum data, double lines classical data. Time flows from left to 
right.) 



Then, 



^W:=E^L where T u := ^P^ 2 , 



(4) 



{N^ 1 / 2 is here defined to be zero outside the support of N. The map T^ x "> is, therefore, defined on 
the image of the subspace S by the map A( w ) o E and can be extended to a CPTP map on all of 
W ® X.) Formally, the decoding map is given by 



D (X) = T (x) o A (w) _ 
The arrangement is illustrated in Figure 1. Our main result is 



(5) 



Theorem 1 Let d be sufficiently large that d k > 48/<5 2 , d n > 10(n + 2)/e and, in the special case k = 1, 



log d 



> 2840 g" +3) . Then if 



32(n + 2) 4 



Ce 2 
Ce 2 5 2 



■ cf _i logd 



d 



and 



_1536(n + 2) 4 \ogd_ 



(6) 



with probability at least 1/2, the encoding map (2) and decoding maps (5) give a (5, e, s, d n )-qubit hiding 
scheme with (k, n) access structure. 

The intuition leading to these choices for r and s is quite simple. First, security of the encod- 
ing against groupings of k — 1 parties will require that our encoding randomize subsystems of 
dimension d^ 1 and smaller. This leads to a choice of r » d fe_1 . On the other hand, successful 
decoding will require the k parties in X to be able to identify the unitary Ui that was applied to the 
input state \(p) G S without damaging the encoded state, which leads to the constraint rs d k . 
Consequently, in light of the randomization requirement, s <^ d. 
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III. PROOFS 

To prove the theorem, we will make extensive use of some well-known facts about Gaussian 
random variables and random quantum states. We use the notation g ~ Wc(0, 1) to denote that 
g is a complex Gaussian random variable with mean and variance 1. That is, g = g^ + ig^ 
where g( x ) and g( y ) are independent, mean 0, variance 1/2 real Gaussian random variables. 

Fact 1 (Lemma 23 of 15]) Let gi ~ A/c(0, 1) be independent complex Gaussian variables. Then, for e > 
the probabilities of large deviations are given by 

i=i 

In particular, for -1 < 5 < 1, we have 5 - ln(l + 5) > ^> which implies that for < e < 1, 

1 N 

Pr (n £ N ' ^ (1 ± e) ) - ex P(- CAre2 ) ' ( g ) 

i=i 

w/jere C can be taken to be (6 In 2)^ x . 
This can be used to derive: 

Fact 2 (adapted from Lemma II. 3 of [19]) Let ipbe a pure state and P be a projector of rank p, both on a 
Hilbert space of dimension d. If {Ui}f =l are chosen independently and according to the Haar measure on 
U(d), then there exists a constant C > (61n2) _1 such that 

^ (W E TrWM,!^) - \\ ± f ) < exp (-N P ±e ~^ ±e} ) . (9) 

IfO < e < 1, we get the simpler upper bound exp(—CNpe 2 ) as in Fact 1. 
We will also use: 

Fact 3 (Lemma II A of [19]) For < e < 1 and dim H = d there exists a set M of pure states in 7i with 
W\ < (5/e) 2d such that for every pure state \ip) £ H there exists \tp) £ M with \\ \(p)((p\ — \<p){<p\ ||i< e. 
(We call such a set an e-net.) 



Theorem 1: Proof of security 



Security is guaranteed if no unauthorized measurement can distinguish any encoded state 
from the maximally mixed state. We would like to show that the probability (over random choices 
of Ui) of the contrary is small. An unauthorized measurement is LOCC and thus separable [3, 4] 
over a partition of the n parties into groups of size < k. We will actually prove security against this 
larger class of measurements. It suffices to consider measurements with rank one POVM elements 
since any measurement can be refined to such a measurement without decreasing distinguisha- 
bility. For example, a measurement implemented by LOCC between three groups of parties W\, 
W 2 and W 3 will have a POVM of the form {Zi = Z, 
on the space Wj . Suppose that it is known that 



(!) 7( 2 ) , 



r^}, where each z\^ is an operator 



Tr[ZiE(<p)] 



Tr[Z t ] < eTr[Zi] 



d n 



2d n 



(10) 
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for all states \ip) G S. Then 



^|Tr[Z^)]-Tr[^- 



e 



(ii) 



confirming the security condition, Eq. (1), for this particular POVM by the triangle inequality 
Thus, it is sufficient to bound 



1 r 1 
Pr ( sup sup Tr[- V ZUnpU}} - — > -^-Y 



(12) 



where the second supremum is over all rank one projectors Z of the form Z = ®™ =1 Z n , with 



q=l n q 



n, < n q < k corresponding to some partition of the n parties into groups of size n q 
and each Z riq a rank one projector on C 1 " 9 . Now, if we let each M Hq be a 2 ( n +2)d n " net ^ or states on 
C d " 9 and Ms an 2 ( w +2)d" " net on ^' tnen 



7* 



> 



2d" 



(13) 



i=i 



2(n + 2)d n 



for some Z„ q G A/"n 9 , </? G jV s . By the union bound, the probability of Eq. (12) is therefore bounded 
above by 



maxiV( n lmaxPr 

M <f>,z 



1 



> 



2(n + 2)d™ 



(14) 



where N{n 9 } = rr^-f (Ilq |)|^/a| is the number of different ways n parties can be divided into 
n groups of size n q , multiplied by the total number of net points that need to be verified. In 
Eq. (14), the first maximization is taken over partitions {n q } of n such that < n q < k, while inner 
maximization is taken over \(p) G M s and Z G x q M Uq ■ (This is a slight abuse of notation; note that 
Z is a rank one projector on the corresponding tensor product space.) Applying Facts 2 and 3, this 
is bounded above by 



inloKn /10(n + 2KV(n + iK 



■k-l 



exp 



/ -Cre 2 \ 
U(n + 2) 2 /' 



(15) 



as long as s < d k 1 , which is the case for fc>l.Iffc = l,all operations are authorized so there is 
no need for a security requirement. If d n > 10 (^+ 2 ) , this is less than \ for r = 32 (g+ 2 ) ^fc-i j Q g ^ 



Theorem 1: Proof of correctness 

Our goal is to show that for any X and for all \ip) G S, ||Z)W o £?(<£>) — tp\\\ < 5, again with 
probability at least 3/4 over choices of {Ui}, so that the probability that the statement isn't true is 
no more than 1/4. This would be implied by (^|(£> {x) o E)(ip)\(p) > 1 - <5 2 /4 for all \<p) G S [14], 
which would in turn be implied by 



V V — [777771 \n2 — > 1 - — := 1 - «• 



(16) 
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So, it suffices to show that Eq. (16) holds with sufficiently high probability for any fixed \ip) G S 
that it can be achieved simultaneously for a net of states on S. 

The proof idea is to take | ip) as a member of an orthonormal basis of S, { \j) }| =1 . The success of 
using to decode the states {PiUi\j)}ij t i can be gauged by considering it as the first piece of a 
two-stage implementation of the Pretty Good Measurement (PGM) [18], the criterion for success 
of which is well-understood [17]. More specifically, let \^ji) = Pi^^=, which is non-zero with 
probability one. According to Eq. (3), N = Yliji F° r an Y state P' 

(j\T ilP Tl\j) = Tr\pT*\j)(j\T a ] (17) 

= TV IpN-^pA^-^lptN- 1 / 2 ] (18) 
L yr s sjr J 

= TrtpiV-V^^X^lTV- 1 ^] (19) 
= Tr[pM^], (20) 
where M iiX := AT" x / 2 1 AT" 1 / 2 is a POVM element of the PGM on the set of unnormalized 

states Lettin § P = ^SIm-? / the LHS of Ec l s - < 16 ) and < 17 ) coindde - while % ( 20 ) 

is the probability that the PGM will correctly identify \\p^ \ j)\\ 2 ■ That is, 

\{j\T u PlUi\3)\ 2 _ Tr[|^)(^7|M u7 ] 

2 lllt...\l|2 • {AL > 



\PiUi\<p)\\i II M 



12 



We must therefore bound the probability of error for the PGM which, it is important to ob- 
serve, is defined on a set of sub-normalized states, where the normalization of each state gives 
its probability. An error bound for any equiprobable ensemble is given in [17], and we provide a 
straightforward generalization to the present case of unequal a priori probabilities in Appendix 
A. Applying this error bound, and using the orthogonality of the states for different values 
of we obtain the following. 

Lemma 1 For each i = 1, . . . , r, 1 = 1,..., d n ~ k , and j = 1, . . . , s, 

1 Kil^^li)! 2 < A i y \ {j >\u}, m ,\ (22 ) 



WiMWi ~ J \{j\u}PiUi\j)\ 2 



(Note that the sum ranges over values of i! from 1 to r and j' from 1 to s, not including the pair 
(i, j).) The intuition behind this result is clear - our probability of misidentification for a fixed 
state scales roughly like the sum of the overlaps of that state with all the states we could mistake 
it for, divided by a normalization factor. 

In order to evaluate Pr(Ay; > a), and thus determine the probability (over random choices 
of Ui) that the probability of misidentifying PiUi\j) (in the PGM) is small, we break up the above 
sum into two terms: 

Am = YY\(j'\u},PiUi\j)\ 2 + Y\(j'\u}PiUi\j)\ 2 

=: Aj,-, + A? 7 . (23) 
We can use Fact 2 to control the size of the denominator in A^-j with the result that 

d k 



Pr 



(j\ujPiU t \j) 
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In general, if a particular event E is excluded by a set of conditions C\ A Ci A • • • , then Pr(E') < 

Pr (-1C1 ) + Pr(-iC2) H . (This holds for arbitrary dependence between E, C\ , C2, ■ ■ ■) We will use 

this observation repeatedly in the arguments below. 

Turning our attention to A* 7 , we see that 



Aj,-, 



IWb")l 2 7S 



1 -'\/ -'irrt 

I j >0 Fi' — 



17* 



(25) 



so, using Eq. (24) we find that Pr(Aj 7 > /3) is bounded above by 



M^EE^^i >")+-(- 



If we choose (r — l)s < /3d k /3 and apply Fact 2, we see that this is no greater than 



(26) 



/ (r - l)s\ / oT \ 

eX H"^4lnTJ +eXp l-24h72J- 



(27) 



We must also deal with A|-j. For k = n, this is identically zero, whereas for 1 < fc < n we rely on 
the following lemma, the proof of which can be found in Appendix B. 

Lemma 2 I/O < j3, e < 1, s < f3d/128 and 1 < k < n, then 



Pr 



( ^ y\(f\ujPiU t \j)\ 2 >p] <4 S exp(--^-V 



(28) 



The lemma applies if we choose s = 



(3Ce 2 



with d large enough that s > 1. Together, 



96(n+2) 4 logd 

Eqs. (27) and (28) imply (letting /3 = f ) that if we choose r and s such that ad k /21 < (r - l)s < 

ad fc /12, 



Pr 



(Ay, > f ) 



- 4seX H-5T2h72J +eXP 

/ ad k \ 
< 6s exp — — — - — - . 
F V 5121n2/ 



(r - l)s 
24 In 2 



+ cxp 



d k 



24 In 2 



(29) 



Eq. (29) tells us that for any \ip) £ S, in the limit of large d, it is overwhelmingly likely that Eq. (16) 
is satisfied, and thus o E(ip) is close to (p. However, we would like to bound the probability 
of error for all states simultaneously. To do this, let rj = l2 ^ n - k and Ms be an ?7-net for S with 
\M S \ < (|) 2s - Then, for 1 < k < n we find 



(tplTuWiltpMujPiT^) 



Pr( inf min 



< 1 -a 



) 



-\v)es i,i (<p\u}PiUi\<p) 

< Pr^3i, i, \<p) £ Ms s.t. {0\T a PiUi\<pmu}m^<p) < {\-^mu\Pium) 

+ Pr(3U|£) GA^S.t. > <£|L/JiWi|$) 

< rd- fe (^) 2S Pr(A^ > I) +^~ fc (^) 2Spr (^ > W^Wm)- (30) 
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Combining this with Eqs. (24) and (29), we finally find that 



Pr ( inf min 

\\<p)es i,i 




ad k 



< 1 



exp 



(31) 



eX K"5T2ln2) +rdn " fc Q) Z%XP ( 



i. / 5 \ 2s 

n—k " \ 



241n2, 



< 



(32) 



we guarantee that the probability of any one of the failing is no more than \. The case of 
k = n can be analyzed in the same way with the exception that the second term in Eq. (30) is 
identically zero, resulting in the requirement that 



/5\2s / a ct k \ 

6r %) eXP l-512hT2J 



< 



1 



(33) 



Both Eq. (32) and Eq. (33) are satisfied if we choose d sufficiently large that d k > 48/e) 2 and, for 
£ _ ^ 2840(^2w+3) < _|_^ c ] loose both r anc j s according to 



r = 



d fc_1 logd 



32(n + 2) 4 

Ce 2 <5 2 
1536(n + 2) 4 ' logd 



(34) 



Combining this with our analysis of the probability that a random choice of encoding is secure, 
we also get the second condition that d n > 10(n + 2)/e. When these requirements are satisfied, 
E(-) and the set of D^ x \-) provide a (<5, e, s, d n ) qubit hiding scheme with (k, n) access structure 
with probability at least 1/2. 



IV. DISCUSSION 

We have shown how to construct multiparty hiding schemes with threshold access structures 
for quantum information. A notable feature of these schemes is that in the limit of hiding a large 
amount of data, the storage requirement approaches one local physical qubit per hidden qubit. 
That is, the share that each party holds is to leading order the same size as the hidden state. The 
accuracy and security parameters incur an overhead that is additive, and therefore negligible from 
the point of view of the asymptotic rate. 

It seems likely that the threshold schemes presented here can be concatenated to provide hid- 
ing schemes with non-zero asymptotic hiding rate for arbitrary realizable access structures. (Re- 
alizable here meaning consistent with monotonicity since a superset of an authorized set must 
also be an authorized set [12, 13].) The question of security under concatenation relates to the 
distillability of our encoding states; if a large amount of entanglement could be distilled from 
the encoding states, access to some of the encoded data could be sacrificed to compromise the 
security of the rest. Luckily, based on the results of [20], we suspect that the encoding states 
have at most a small amount of distillable entanglement between sub-threshold sets of parties, 
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perhaps even a vanishing amount. Still, the connection between the theory of multipartite entan- 
glement and multiparty data hiding is not well understood and deserves further investigation. 
At the very least, the states used here have been engineered with very extreme properties: small 
sub-threshold distinguishability, high symmetry, high entanglement of formation and likely low 
distillable entanglement. 

Beyond the question of security under concatenation, it would be worth knowing whether a 
composable definition of data hiding could be formulated and whether the schemes presented 
here would realize the definition. In a similar vein, we would like to know the extent to which 
the schemes presented here are stable against small amounts of entanglement shared between the 
parties; does security fail all at once or gracefully? Can schemes completely robust against finite 
amounts of entanglement be designed? The strongest possible such result would be a demonstra- 
tion that the schemes are secure whenever there is insufficient entanglement to teleport any local 
shares. 

Moreover, while imperfect security is inevitable in data hiding (at least in the absence of su- 
perselection rules [22, 26]), perfect accuracy is possible, as demonstrated by [9] and [10]. Is perfect 
accuracy possible while simultaneously achieving the rates found in this paper? Since the bulk of 
the technical difficulty in the present paper comes from proving the existence of sufficiently good, 
albeit imperfect decodings, a scheme with perfect decodings could conceivably be significantly 
simpler. 

Finally, while we have not provided an explicit construction of the encoding map, it is im- 
portant to notice that the probability of 1/2 in Theorem 1 is arbitrary, and could be chosen ar- 
bitrarily close to one at the expense of increasing (decreasing) the proportionality constant for 
r (s) in Eq. (6). In this sense, secure and accurate hiding schemes of the form we present are 
generic in the limit of large dimension. Nevertheless, it would be more satisfying to find explicit, 
non-probabilistic choices for the encoding unitaries, implementable in polynomial time, and still 
giving secure and accurate data hiding schemes, as was done for approximate encryption in [1]. 



The circuits in Figure 1 were typeset using the Q-circuit WcgX. package written by Bryan Eastin 
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APPENDIX A: SUCCESS CRITERION FOR THE PGM WITH UNEQUAL STATE PROPABILITIES 

Using the method of [17], we will bound the probability of error for the PGM when the states 
occur with unequal probabilities. (The symbols used in this derivation are locally defined.) Let 
be a set of subnormalized states so that represents the probability of and iV = 

Ei l&X&l- Th e elements of the PGM are M, L = N- 1 / 2 \^ i \N- 1 / 2 . We define the matrix 
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In terms of T, the probability of the PGM correctly identifying is 

Applying the inequality y/x > |x - |x 2 to the matrix = (which we are able to do, since 

the present choices of \fx and x are Hermitian and nonnegative) and noting that the inequality 
holds for the diagonal entries gives 



(VT) U 3 Tg l v l^f 1 v iT^f _ 1 V KM 

Combining Eq. (A3) and Eq. (A4) yields the result 

WW 



2 



(A4) 



which is equivalent to 



APPENDIX B: PROOF OF LEMMA 2 

We would like to show that if < (3, e < 1, s < (3d/l28 and 1 < k < n, then 

Pr| Y\(f\u}PiUi\j)\ 2 > p) <4sexp(- -ff - ). (Bl) 

Our argument is somewhat lengthy but completely elementary. We will make use of the fact that a 
Haar-distributed state in C d ' can be expressed as m^| 2 where (7) is a d! -dimensional vector with all 
coordinates drawn independently from A/"c(0, 1). (Throughout this section, any variable written 
as g x , g y x or g^ y , for arbitrary values of x, y, a and b, will denote a random variable drawn from 
Mc(0, !)• They are all chosen independently.) To begin, we can express the marginal distributions 
of the Ui\f) in terms of complex Gaussians (ignoring correlations between the vectors U^) and 
Ui\j' 2 )): 

e 
2 

N 



It will also be useful to note that e — ln(l + e) > § if e > 6, in which case Eq. (8) can be replaced by 

1 N 

P.(^W ! >(U<))<»p(-^). (B3) 
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Using Eqs. (8) and (B3), the fact that cP" 1 > 128s and recalling that f = 1, . . . , s, we find 



f- 1 U.|2 



z^i= 3 ' \yi\ i=i 



,2 . 1 d n -f 



> 



) + p r (Eirf< <i "" / 



) 



£ex H-^) +ex H-^)^M-^)' < B4 > 



which will be useful below. To complete our task, however, we will need to move beyond the 
simplest Gaussian approximation to the distribution of the {Ui\j')} that takes into account the 
correlations between the vectors for different values of f. We can relate {Ui\j')} to a collection of 
independent Haar-distributed vectors, ), as follows: 



W) 



— , v J2\9i'\ 2 Ui\j')+ J J29i'Ui\t) 



(B5) 



To see this, notice that Ui\j'} is distributed uniformly in the orthogonal complement to the span 
of {Ui\t)}i~i , which means that it can be represented as Ui\f) = {J2t=j> \fft | 2 ) -1 ^ 2 Ylt=j' 9t \H )' 
where { | \P t ) } forms an orthonormal basis of the complement space. Substituting this into the ex- 
pression above shows that | ^ ) is simply a Gaussian state divided by its norm - a Haar distributed 
state. Choosing the g\ independently guarantees that the will be independent. 
Now, without loss of generality, we'll choose j = 1, so that our goal is to estimate 



|(l|C/t PA |l)|2^ 



(B6) 



Inverting Eq. (B5) gives 

Ui\j') 

so that 



W ) - 



L—'£d'Ui\t) 



E^lsfl 2 " 



(B7) 



'T d l \q f \ 2 ■ 

WiPiUitf) = \ , WiPiw') - , = „ £ gt'wjpmt). (B8) 



2^t=j' \9t I 



Using the inequality \a + b\ 2 < 2(\a\ 2 + |6| 2 ) then leads to 

>cp | j'|2 



milium 2 < 2( ^: lb ;J 2 2 i(ii^pn^)i 2 + - f l^ai'mim^f) 

l^t=i' \9t I 2^t=j' \9t I t=i 



< 2 



Summing over values of f in Eq. (B9) and using Eq. (B4) shows that 

/ s s s s \ 

Pr £ Kiit/tp^,!/)! 2 > 2 (]T(i + l)|(i|[/tp|^')|2 + ^1^ \(i\u*Wi\t)\ 2 ) (bio) 



Vj'=2 



J'=2 



i'=2 t=i 
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is less than or equal to 2s exp (— ^"^2 )/ which implies in turn that 

pr Kipiwm 2 > 4 e kiic/^i^")! 2 + iui^wi 2 + ii<ii^wii>i 2> ) 

V=2 j'=2 t=2 / 

(Bll) 

is bounded above by the same 2s exp^— -g^^ ) • Moving the second sum on the RHS to the LHS 
and noting | < 1 shows that 

Pr f r i V \{1\U} Pmj 1 )? > Y |(1|[/M|V> J ">| 2 + -, I (B12) 

is again bounded above by 2s exp ^— ^"n^ ) ■ Finally, we can upper bound 

Prf Y |(l|£/tp^")| 2 > A j (B13) 



by using Fact 2, Eq. (24) and the estimate leading to Eq. (B3), along with the observation that 
l^ 1 ) = Ui\l), with the result that the probability in Eq. (B13) is less than or equal to 

Combining this with the bound on Eq. (B12) and noting § < § gives the result 

Prf T~ Y \{l\u}PlUi\j')\ 2 > P] 

/ 8d k \ / d k \ / d n_1 \ / /?<i fc \ 

£ exp ( - 1^2) + exp ( - 241^2) + 28 exp ( - 32k7l) £ 48 exp ( - ditaa) • (B15) 
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